Don’t run your own OpenID server; delegate to a trusted provider instead!

UPDATE: The following article has been proven to be largely inaccurate.  If you want to set up an OpenID on your own domain, flip down to the comments below by Carsten Pötter to see how to set up an OpenID “delegate”.  This lets you use a big OpenID provider of your choice while still maintaining your own custom domain name.  I highly recommend this as running your own OpenID validation code is a chore.  Just set up a delegate to point from your domain to MyOpenID or somewhere similar.

- Daniel

My own personal OpenID failure

I haven’t been able to access my own OpenID since November. I made the mistake of binding many of my social network accounts to the “www.sharingatwork.com” OpenID back when I was hosted by Blogger.  I lost them when I moved away from Blogger.  This isn’t anyone’s fault but mine, and yet I still feel obligated to share this cautionary tale:

I started this blog as danielpritchett.blogspot.com using free hosting from Blogger (i.e Blogspot) last July.   After a month or two I was pretty sure I liked the whole blogging thing and I knew I’d like to move on to a more customizable platform.  Hosted Wordpress was my obvious choice so I moved over to Tubu in November.

I strongly support collaboration software and as I’ve mentioned repeatedly on this blog I enjoy things that reduce barriers to participation.  User registrations and logins are the first and biggest barriers most sites present to collaboration, so I’ve been using OpenID where I can’t get an even easier method of single sign on.  That worked out fine well for me until I made the decision to sever my connection with Blogger.

Where my OpenID went wrong

It wasn’t a bad idea on the surface to use www.sharingatwork.com as my OpenID address.  My blog was run by Blogger (i.e. Google) and so it enjoyed strong uptime and decent free support.  When I switched to a hosted blog service, uninterrupted OpenID support was rather low on my list of priorities, but I assumed I could take care of it.  I tried a WordPress plugin that claimed OpenID support but it’s not working for me.  The plugin authors have been working their way through variations on this problem for a few months now, and I’ve no doubt they’ll eventually get it fixed.

Once my personal OpenID inevitably comes back up I’ll use it to log in to all of my five-months-dormant accounts and move them to a more dependable OpenID provider.  I appreciate the product and service Tubu’s given me, but I should never have tried to cram OpenID into my $10/year blog hosting package.

What I should have done (and what you should do!)

If you want an OpenID of your own, I recommend you pick one up from a bigger and more dependable OpenID provider such as the ones recommended at OpenID.net.  It’s your choice whether you want to use a standalone OpenID service like ClaimID or the OpenID feature of a larger web property like AOL, but either choice is less likely to cause headaches than foolishly running your own OpenID server like I did.

What does this say about OpenID?

First and foremost this shows that OpenID is still a developing technology and that best practices haven’t been perfectly ironed out.  I’m sure a personal OpenID provider can work for some people, but in my case it’s turned out to be more than it’s worth.  I’ve got the training and experience to be able to fix this WordPress plugin that’s giving me grief, but it’s not the sort of thing I’m interested in devoting my time to this year.  Most bloggers won’t even have the programming and computer security background to pretend – like I am – that they could fix it if they so chose.

Portable logins are still a big part of the future of consumer web interactions, but I have to grudingly admit that the legions of OpenID detractors (hi Mona!) have a point.  If someone with my technical background can’t easily make the right choices to navigate the user authentication minefield, what hope do non-technical surfers have of choosing the right solution? There’s still work to be done.

I’d like to say that Facebook Connect is the stopgap I need right now, but my Fortune 100 employer’s firewall blocks *.facebook.com so I can’t use that service in the way I’d like to.  Maybe Google’s FBConnect competitor will morph into something useful soon.  Nobody outside of China blocks Google at the firewall, right?

Funny(?) aside: The first post on this blog was about OpenIDs and how great they’d be at minimizing registration and sign-in headaches.

Related articles by Zemanta

• Blogger connects to Google Friend Connect (googleblog.blogspot.com)
• Friend Connect: Grow Your Blog’s Community (buzz.blogger.com)
• How Facebook Connect Points the Way Towards Velvet Rope Networks (chrisbrogan.com)